# DF-0282 — Signed tx_cred overflow + OOB credit byte read in UIH reception

## Claim
`ng_btsocket_rfcomm_receive_uih()` (`ng_btsocket_rfcomm.c:2409-2417`):
- `tx_cred` is `int16_t` (`ng_btsocket_rfcomm.h:296`); `pcb->tx_cred +=
  *mtod(m0, u_int8_t *)` (line 2416) has no upper bound → ~130 credit UIH frames
  overflow `int16_t`.
- A zero-length UIH with PF set reads `*mtod(m0, u_int8_t *)` (lines 2413/2416)
  with no `m_pkthdr.len >= 1` check → stale mbuf byte used as credit.

## Runtime status
**NOT runtime-testable** — the `ng_btsocket` RFCOMM module is not present on this
guest (`/boot/kernel/ng_bt*` absent) and there is no Bluetooth hardware to carry
an RFCOMM session. Both defects are **definitively confirmed by source trace**
(`VERDICT.md`).

## Reproduce (requires Bluetooth stack + RFCOMM session)
Establish an L2CAP RFCOMM session, then (a) send ~130 UIH frames with PF set and
max credit byte to overflow `tx_cred`, or (b) send a zero-length UIH with PF set
to read a stale credit byte. Not exercisable on this guest.

## Fix
`fix.diff` adds a `m_pkthdr.len < 1` guard before reading the credit byte and
clamps `tx_cred` to `RFCOMM_MAX_CREDITS` (40). Applies + compiles (ng_btsocket
module).